The Hacker Recipes

Appearance

🛠️ SSH ​

Theory ​

The SSH protocol (Secure Shell) is used to login from one machine to another securely. It offers several options for strong authentication, as it protects the connections and communications security and integrity with strong encryption. This connection can be used for terminal access, file transfers, and for tunneling other applications.

Enumeration ​

Authentication type ​

It is possible to enumerate the allowed authentication types with the following command:

bash
ssh -v 
OpenSSH_8.1p1, OpenSSL 1.1.1d 10 Sep 2019
...
debug1: Authentications that can continue: publickey,password,keyboard-interactive

Useful to get basic information about the SSH server such as its type and version.

bash
nc -vn  22
...
SSH-2.0-OpenSSH_7.4p1 Debian-10+deb9u7

Server's public SSH key ​

bash
ssh-keyscan -t rsa  -p

Weak Cipher Algorithms ​

Some auditing tools can help to quikly find the target version and which algorithms are available on the server in order to give recommendations to the customer.

bash
sslscan :22

SSH fuzzing ​

Fuzzing the SSH service could help to find vulnerabilities. The automated fuzzing is simple but not very targeted so it usually takes a lot of time and could miss some results.
The custom and the manual approach is more effective but it takes time to familiarize yourself with the target. Here is an example of a custom fuzzing : Fuzzing the OpenSSH daemon using AFL.

bash
msfconsole
use auxiliary/fuzzers/ssh/ssh_version_2
set RHOSTS 
run

Attacks ​

Weak cryptographic keys ​

Authentication bruteforcing ​

User enumeration ​

bash
msfconsole
use scanner/ssh/ssh_enumusers
set RHOSTS 
set USER_FILE

Password Bruteforcing ​

bash
hydra -l  -s 22 -P   -t 4 ssh

Some common ssh credentials here and here.

Private key Bruteforcing ​

Resources ​

https://book.hacktricks.xyz/pentesting/pentesting-ssh

https://community.turgensec.com/ssh-hacking-guide/